Edge datapath using user-kernel transports

ABSTRACT

A novel design of a gateway that handles traffic in and out of a network by using a datapath daemon is provided. The datapath daemon is a run-to-completion process that performs various data-plane packet-processing operations at the edge of the network. In some embodiments, the datapath daemon dispatches packets to other processes or processing threads outside of the daemon. In some embodiments, the datapath daemon dispatches packets to a kernel network stack in order to support packet traffic monitoring.

CLAIM OF BENEFIT TO PRIOR APPLICATIONS

The present application claims the benefit of U.S. Provisional PatentApplication 62/110,061, filed Jan. 30, 2015. U.S. Provisional PatentApplication 62/110,061 is incorporated herein by reference.

BACKGROUND

A gateway is a network point that acts as an entrance to anothernetwork. In a network provided by a datacenter, a computing resourceassigned to be a gateway node facilitates and regulates traffic betweenthe datacenter network and an external physical network. The gateway istypically is associated with a router, which knows where to direct agiven packet of data that arrives at the gateway, and a switch, whichfurnishes the actual path in and out of the gateway for a given packet.The gateway is also a compute node that provides various network trafficservices, such as firewall, network address translation (NAT), securityprotocols (such as HTTP over SSL), etc. As datacenters become larger andprovide ever more computing and networking resources, gateways also haveto handle more traffic. In other words, the gateways and theirassociated routers and switches have to perform more switching, routing,and service tasks at greater speed.

SUMMARY

Some embodiments provide a gateway machine that handles traffic in andout of a network by implementing a datapath daemon. The datapath daemonis a run-to-completion process that performs various data-planepacket-processing operations at the edge of the network. In someembodiments, the datapath daemon dispatches packets to other processesor processing threads outside of the daemon.

Some embodiments offload workload from one or more of the datapathstages from the datapath daemon to processes or threads that areexternal to the datapath daemon. Such processes can be performed by thesame processing core that performs the datapath daemon, by a differentprocessing core as the core that performs the datapath daemon, or bymultiple processing cores. In some embodiments, gateway is operating anoperating system such as Linux that divides memory space into user spaceand kernel space. The datapath daemon in some of these embodiments is aprocess operating in the user space. The user space datapath daemondispatches packet to processes operating in the kernel space or to otherprocesses operating in the user space in some embodiments.

In some embodiments, the datapath daemon copies packets to processes orthreads outside of the datapath daemon. This packet copying operation isanalogous to operations of a Switched Port Analyzer (SPAN), whichmirrors packet to a port for monitoring purposes. In some embodiments,such packet replication occurs when the datapath daemon is at aparticular point or stage of the datapath pipeline when processing anincoming packet. In other words, the datapath daemon mirrors packets outof the daemon before or after certain packet processing operations.

In some embodiments, the datapath daemon of an edge gateway offloadsworkload by performing one or more of its stages or operations by usingprocesses or processing threads that are external the datapath daemon.In some of these embodiments, the datapath daemon dispatches packets tothose external processes at certain points of the datapath daemon. Insome embodiments, the datapath daemon uses the result of the externalprocess to execute subsequent pipeline stages. In some embodiments, agateway datapath daemon includes a L7 load balancing stage (applicationlayer load balancer) that dispatches packet to an external process ordaemon to handle the load balancing tasks before returning a resultingpacket to the datapath daemon to continue subsequent stages.

In some embodiments, both the datapath daemon and the external processare user space processes, and the inter-process transport for sendingpackets from the datapath daemon to the external process are sharedmemory structures such as ring buffers. In some embodiments, thedatapath daemon is a user space process while the external process iseither a kernel space process or a user space process that communicateswith the datapath daemon through kernel space process or processingthread such as a network stack (e.g., TCP/IP stack.) In some of theseembodiments, datapath daemon uses user-kernel data transport mechanismsuch as KNI (Kernel NIC Interface) or TUN/TAP virtual network kerneldevices to deliver packets between the user space datapath daemon andthe external process.

In some embodiments, the operating system of the gateway machineprovides a network protocol stack as a processing thread in its kernelspace. Such a network stack is normally used to handle network protocolsfor packets at a NIC (Network Interface Controller) of the gatewaymachine. Rather than implementing another network protocol stack in theuser space, some embodiments leverages the existing kernel network stackto perform various operations. In some embodiments, the datapath daemonsends mirrored packets to the network stack through user-kerneltransport (such as KNI), which is treated as a NIC by the kernel networkstack. Once the packet reaches the kernel network stack, the gatewaymachine is able to utilize the functionalities of the kernel stack as ifthe datapath packet is directly provided by the physical NIC.

In some embodiments, the datapath daemon mirrors packet to the networkstack so a user of the gateway would be able to use tcpdump command toview packets flowing through various logical entities or logical portsof the datapath. In some embodiments, the DP configuration database ofthe datapath daemon specifies from which logical ports or from whichlogical entities should the packets be mirrored to the kernel networkstack. These packets are then in turn available for analysis by toolssuch as tcpdump.

Some embodiments dispatch packets from the datapath daemon to other userspace processes. In some embodiments, these user space processes are forprocessing control plane packets of the network such as BGP packets.These packets are not to be forwarded in the data plane, but are insteadconsumed by control plane processes. The datapath daemon in someembodiments dispatches these control plane packets to theircorresponding control plane processes. Specifically, the packets aredispatched to the network stack from the datapath daemon throughuser-kernel transport, and the network stack in turn delivers the packetto its corresponding control plane process. In some embodiments, acontrol plane packet (such as BGP packet) has identifiers that arerecognizable by the network stack that can be used to deliver the packetto the corresponding control plane user process.

In some embodiments, the control plane process is regarded as beingperformed by a logical entity in the logical network, specifically inthe service router. In some embodiments, the datapath has a dispatchstage that corresponds to the control plane process. In someembodiments, such a stage is for determining whether the packet is forthe control plane process or not. For example, in some embodiments, thedatapath's service router includes a BGP dispatch stage for determiningwhether the incoming packet is a BGP packet. If so, the datapath daemonterminates processing of the packet and let the BGP process consumes theBGP packet and performs the corresponding BGP operations.

In some embodiments, not all datapath tasks are performed by thedatapath daemon. Specifically, the datapath daemon in some embodimentsexports packets (by dispatching packets to kernel network stack throughuser-kernel transport) to an external data plane process for some of thedatapath stages. In some embodiments, the external data plane processwould transport the processed packet back to the datapath daemon tocontinue datapath processing.

The preceding Summary is intended to serve as a brief introduction tosome embodiments of the invention. It is not meant to be an introductionor overview of all inventive subject matter disclosed in this document.The Detailed Description that follows and the Drawings that are referredto in the Detailed Description will further describe the embodimentsdescribed in the Summary as well as other embodiments. Accordingly, tounderstand all the embodiments described by this document, a full reviewof the Summary, Detailed Description and the Drawings is needed.Moreover, the claimed subject matters are not to be limited by theillustrative details in the Summary, Detailed Description and theDrawings, but rather are to be defined by the appended claims, becausethe claimed subject matters can be embodied in other specific formswithout departing from the spirit of the subject matters.

BRIEF DESCRIPTION OF THE DRAWINGS

The novel features of the invention are set forth in the appendedclaims. However, for purpose of explanation, several embodiments of theinvention are set forth in the following figures.

FIG. 1 conceptually illustrates a data center whose traffic to and froman external network goes through gateways.

FIG. 2 illustrates a gateway machine implementing a datapath pipeline ingreater detail.

FIG. 3 illustrates the dynamic identification of processing stages by adatapath daemon.

FIG. 4 illustrates a logical network with both distributed andcentralized logical entities.

FIG. 5 illustrates a datapath daemon mirroring packets to an externalprocess.

FIG. 6 illustrates a datapath daemon performing one of its stages byusing an external process (or external daemon).

FIGS. 7a-b illustrates a datapath daemon handling an incoming packetthat is destined for the control plane by dispatching the control planepacket to a control plane process.

FIG. 8 illustrates a user space datapath daemon that communicates with akernel network stack through a user-kernel transport and a networkstack.

FIG. 9 conceptually illustrates a process for performing a gatewaydatapath.

FIG. 10 conceptually illustrates a process for performing a datapathstage.

FIG. 11 conceptually illustrates a gateway machine that sends packetsfrom specified operational points of a user space datapath to the kernelnetwork stack.

FIG. 12 illustrates using tcpdump and kernel network space to analyzethe packet traffic of a gateway's datapath.

FIG. 13 conceptually illustrates a process for using kernel networkstack to perform packet traffic analysis of the datapath daemon in userspace.

FIGS. 14a-b illustrates a datapath daemon that forwards BGP packets to aBGP daemon that is external to the datapath.

FIG. 15 illustrates the mirroring of packets from a datapath daemon to aBGP daemon.

FIG. 16 illustrates the configuring of a datapath daemon by BGP routeslearned by BGP control plane processes external to the dataphat daemon.

FIG. 17 conceptually illustrates a process by which the datapath daemonsends control plane packet to an external control plane process.

FIG. 18 illustrates the architecture of a gateway machine according tosome embodiments of the invention.

FIG. 19a conceptually illustrates a RTC thread using IPC to communicatewith service processes in order to provide services.

FIG. 19b conceptually illustrates a RTC thread using Linux Kernel tocommunicate with service processes in order to provide services.

FIG. 20 illustrates a computing device that serves as a host machinethat runs virtualization software for some embodiments of the invention.

FIG. 21 conceptually illustrates an electronic system with which someembodiments of the invention are implemented.

DETAILED DESCRIPTION

In the following description, numerous details are set forth for thepurpose of explanation. However, one of ordinary skill in the art willrealize that the invention may be practiced without the use of thesespecific details. In other instances, well-known structures and devicesare shown in block diagram form in order not to obscure the descriptionof the invention with unnecessary detail.

Some embodiments provide a gateway machine that handles traffic in andout of a network by implementing a datapath daemon. The datapath daemonis a run-to-completion process that performs various data-planepacket-processing operations at the edge of the network. In someembodiments, the datapath daemon dispatches packets to other processesor processing threads outside of the daemon.

Several more detailed embodiments of the invention are described below.Section I describes a datapath daemon at an edge gateway of a network.Section II describes a datapath daemon that dispatches packets toprocesses outside of the daemon. Section III describes datapathoperations that leverage the existing network stack in the kernel.Section IV describes a software architecture of a gateway thatimplements the datapath pipeline. Section V describes a computing deviceoperating virtualization software. Finally, section VI describes anelectronic system with which some embodiments of the invention areimplemented.

I. Data Path Daemon at Edge Gateway

FIG. 1 conceptually illustrates a data center 100 whose traffic to andfrom an external network 190 goes through gateways 111-112. Each of thegateways operates a datapath pipeline (141 and 142 respectively) forprocessing packets that go through the gateway.

The datacenter 100 includes various other computing and networkingresources 121-129 that are interlinked by a provider network. Theseresources communicate with each other through the provider network andwith the external network 190 by network traffic over physicalcommunication mediums (which can include wired communications such asEthernet or wireless communications such as WiFi). Packets from thecomputing and networking resources 121-129 can reach the externalnetwork 190 through one of the gateways 111-112, and packets from theexternal network 190 can reach the computing and network resources121-129 through one of the gateways 111-112. A gateway of a network istherefore regarded as being at the edge of the network and thereforealso referred to as an edge device or edge node.

In some embodiments, some of these resources are provided by computingdevices serving as host machines 121-129. Some of these host machinesoperate virtualization software, which allow these host machines to hostvarious virtual machines (VMs). A host machine running virtualizationsoftware will be described in greater detail by reference to FIG. 20below. In some embodiments, a gateway is itself a host machine, anddatapath pipeline (141 or 142) of the gateway is provided by one of theVMs running on its virtualization software. Some of these resources arerunning as “bare metal”, i.e., without virtualization software. In someembodiments, the gateway is a bare metal computing device that operatesits datapath pipeline directly over its own operating system withoutvirtualization software.

In some embodiments, the packet traffic within the datacenter isconducted by using overlay logical networks such as Virtual eXtensibleLAN (VXLAN), Generic Network Virtualization Encapsulation (GENEVE), andNetwork Virtualization using Generic Routing Encapsulation (NVGRE).VXLAN. In some of these embodiments, each of the host machines and thegateway machines is a VXLAN endpoint (referred to as VTEP) thattransmits packets using overlay encapsulation. In some embodiments, theexternal physical network is conducted by VLAN, and the gateways relaythe traffic between the datacenter and the external network bytranslating VXLAN packets to VLAN packets and vice versa.

In some embodiments, the computing and networking resources of thedatacenter implement one or more logical networks, each logical networkhaving access to the gateways 111-112 for traffic to and from theexternal network 190. In some embodiments, each logical network has itsown set of logical routers and logical switches for conducting networktraffic of the logical network. Some or all of these logical routers andswitches are provided by software operating in the host machines (eitheras virtualization software or as programs executing on bare metal hostmachines). In some embodiments, some of the logical routers and switchesoperate in the gateways 111-112 as stages in their respective datapathpipelines 141-142.

In some embodiments, the datacenter 100 includes a network manager 180for provisioning/creating the logical networks in the data center 100and a network controller 170 (or a cluster of controller) forcontrolling the various logical routers and switches (including thoseoperating in the gateways 111-112) of the various logical networks.Logical routers and switches are described in U.S. patent applicationSer. No. 14/814,473, titled “Logical Router with Multiple RoutingComponents” and filed on Jun. 30, 2015, and is now issued a U.S. Pat.No. 9,787,605, which is incorporated herein by reference.

The control plane of some embodiments configures and manages one or morelogical networks for one or more tenants of a hosting system (e.g., adatacenter). In some embodiments, a logical network of the hostingsystem logically connects a set of end machines (e.g., virtual machines,physical servers, containers, etc.) to a set of physical machines usinga set of logical forwarding elements (e.g., logical L2 and L3 switches).In some embodiments, different subsets of end machines reside ondifferent host machines that execute managed forwarding elements (MFEs),also known as virtualization software or hypervisors. The MFEs implementthe logical forwarding elements of the logical network to which thelocal end machines are logically connected. These MFEs may be flow-basedforwarding elements (e.g., Open vSwitch) or code-based forwardingelements (e.g., ESX), or a combination of the two, in various differentembodiments. These different types of forwarding elements implement thevarious logical forwarding elements differently, but in each case theyexecute a pipeline for each logical forwarding element that may berequired to process a packet.

FIG. 2 illustrates a gateway machine implementing a datapath pipeline ingreater detail. As illustrated, the gateway 111 comprises processingcores 211-214 and a network interface controller (NIC) 220. The NIC 220receives data packets from the network communication medium thatconnects the gateway 111 and provide the received packets to the cores211-214 for processing.

Each of the processing cores is operating one or more processingthreads. Specifically, the core 211 is operating the datapath pipeline141 as a processing thread that is referred to as a datapath daemon 241.As illustrated, the datapath daemon 241 receives a packet 270 andprocesses the packet 270 through a series of stages 221-229 to produce aprocessed packet 275. In some embodiments, each core performs only onethread at a time, and each thread processes one packet at a time. Inother words, each packet processing thread is a run-to-completion (RTC)thread that does not start to process another packet until it hascompleted processing the current packet (i.e. 270) through all of itsstages 221-229.

The operations of the datapath daemon 241 is defined or specified by adata path configuration database storage (DP configuration database)230. The configuration data stored in DP configuration database 230specifies what functions or operations each stage of the pipeline shouldperform with regard to each incoming packet. For some stages thatcorrespond to logical routers or switches, the DP configuration databasein some embodiments provide content for routing tables or forwardingtables that specify next hops. For some stages that correspond tonetwork services such as firewall, the DP configuration database 230provides service rules. In some embodiments, the network controller 170(or the network manager 180) loads and updates the content of DPconfiguration database 230.

In some embodiments, the sequence of the stages that are to be executedas part of the datapath pipeline is dynamically determined according tothe content of the received packet. In the context of FIG. 2, this meansthat the content of the packet 270 dynamically determines whatprocessing stages are to be performed as part of the datapath pipeline141. In some embodiments, the core 211 when processing/parsing thepacket at a particular stage determines or identifies the next stagethat is to be used for processing the packet. In some embodiments, eachstage of the datapath pipeline corresponds to a packet-processinglogical entity such as logical router or logical switch, and the nextstage identified by the packet processing at the stage corresponds tothe next hop of the packet in the logical network, the next hop beinganother packet-processing logical entity. (A packet-forwarding logicalentity will be referred to as a logical entity throughout this documentfor simplicity).

In some embodiments, a pipeline stage that corresponds to a logicalrouter or a logical switch is a complete functional model of the logicalrouter or switch, i.e., it specifies all of its logical ports, itsrouting/forwarding tables, the services it provides, its securitypolicies, its encapsulation protocols, etc. In some embodiments, all ofthese features of the logical routers are specified by a package ofcomputer executable code and can be performed as a pipeline stage by afunction call. It performs forwarding either by destination MAC (L2switching) or destination IP (L3 routing). Such a pipeline stage istherefore distinguishable from a flow table under OpenFlow or OpenvSwitch, which performs flow forwarding according to a set of flowentries, each entry describing a match condition and a correspondingaction.

In some embodiments, the packet processing operations of each logicalentity (i.e., pipeline stage) is based on the configuration data storedin the DP configuration database for that logical entity. Suchconfiguration data also defines the criteria or the rules foridentifying the next hop of the packet. In some embodiments, such nexthop identifying rules are stored in the DP configuration database asrouting tables or forwarding tables associated with the stage. Such nexthop identifying rules in some embodiments allow the datapath daemon todetermine the identity of the next hop by examining the content of thepacket (e.g., its source and destination addresses) and/or by noting thelogical port through which the packet enters the logical entity. Inother words, the DP configuration database can be regarded as storingthe logical relationship between the various hops of a logical network,and the datapath daemon processes each packet by traversing the logicalnetwork according to those logical relationships and the content of thepacket.

FIG. 3 illustrates the dynamic identification of processing stages by adatapath daemon. As illustrated, the core 211 is operating the datapathdaemon 241 as a processing thread. The datapath daemon 241 is processinga packet 371 according to a logical network 300, whose configurationdata is stored in the DP configuration database 230.

As illustrated, the logical network 300 includes service routers 311 and312 (SR1 and SR2), logical switches 321, 322, and 323 (LS1, LS2, andTLS), and distributed router 313 (DR). Each of the service routers SR1and SR2 has an uplink (U1 and U2) for connecting to the external network190. The logical switch TLS 323 is a transit logic switch that providesL2 switching for packets from routers SR1 311, SR2 312, and DR1 313,which are assigned logical ports with MAC address “MAC1”, “MAC2”, and“MAC3” respectively. The distributed router DR1 313 on the other handprovides L3 routing among L2 network segments defined by the logicalswitches LS1 321, LS2 322, and TLS 323.

The figure illustrates how the datapath daemon 241 processes twodifferent packets 371 and 372 according to the configuration data storedin the DP configuration database 230. The two different packets causethe datapath daemon 241 to traverse the logical network 300 differentlyand to execute different corresponding pipeline stages.

The packet 371 is a packet from the external network 190 that isdestined for a VM 381 (VM1) behind the L2 segment of the logical switchLS1. The processing core 211 upon receiving the packet 371 performs apacket processing stage 351 that corresponds to the service router SR1311. The operations of the stage 351 are defined by the configuration inthe DP configuration database. The service router SR1 311 logicallyforwards the packet to the logical switch TLS 323, which causes thedatapath daemon 241 to identify a next packet processing stage 352 thatcorresponds to the logical switch TLS 323.

The processing stage 352 is configured by DP configuration database 230to perform L2 switching operations as the logical switch TLS 323, whichforwards the packet 371 from its “MAC1” port to its “MAC3” port. TheMAC3 port correspond to the distributed router DR1, and the datapathdaemon 241 correspondingly identifies a next packet processing stage 353that corresponds to DR1 313.

The processing stage 353 is configured by the DP configuration database230 to perform L3 routing operations as the distributed logical routerDR1 313, which operates according to a routing table provided by the DPconfiguration database 230. According to the routing table and thedestination IP address of the packet 371, the logical router DR1 routesthe packet 371 from the L2 segment defined by the logical switch TLS 323to an L2 segment defined by the logical switch LS1 321. Correspondingly,the datapath daemon 241 identifies a next packet processing stage 354that corresponds to LS1 321.

The processing stage 354 is configured by DP configuration database 230to perform L2 switching operations as the logical switch LS1 321, whichforwards the packet 371 toward the virtual machine VM1 (381) accordingto the packet's destination MAC address.

The packet 372 is destined for a VM 382 that is attached to a L2 segmentdefined by the logical switch LS2. The packet 372 causes the datapathdaemon 241 to identify a packet processing stage 361 to perform theservice router SR1, then identify a packet processing stage 362 toperform the logical switch TLS 323, then identify a packet process stage363 to perform the distributed router DR 313. When processing the packet372, the packet processing stage 363 routes the packet from the L2segment defined by the logical switch TLS 323 to an L2 segment definedby the logical switch LS2 322. Correspondingly, the datapath daemon 241identifies a next packet processing stage 364 that corresponds to thelogical switch LS2 322, which forwards the packet 372 toward the virtualmachine VM2 (382) according to the packet's destination MAC address.

In the example of FIG. 3, though the datapath daemon 241 operateaccording to the same DP configuration database 230, the two differentpackets 371 and 372 causes the datapath daemon to traverse the logicalnetwork 300 differently and performed different packet processing stages(SR1-TLS-DR1-LS1 for the packet 371, SR1-TLS-DR1-LS2 for the packet372).

In some embodiments, each packet processing stage is implemented as afunction call for the datapath daemon thread. In some embodiments, afunction (also known as a subroutine or a procedure) is a sequence ofprogram instructions that are packaged as unit to perform a specifictask. In some embodiments, the function being called to implement thevarious stages of the datapath is part of the programming of thedatapath daemon operating at the core, but the called function performsdifferent operations based on different configuration data for differentnetwork identities. In other words, the programming of the core providesfunctions that can be called by the datapath daemon to perform thefunctions of the various logical routers, logical switches, and serviceproviding entities.

The function call uses the content of the packet as an input argument.In some embodiments, the function call also uses the identity of thelogical port through which the packet enters the corresponding logicalentity as an input argument. In some embodiments, the function call alsoidentifies an egress port, which is used to identify the ingress port ofthe next function call for the next pipeline stage.

In some embodiments, some of the logical entities/elements of a logicalnetwork are distributed among multiple physical machines in thedatacenter, i.e., each of these host machines has a copy or instance ofthe distributed logical entity. A packet requiring processing by adistributed logical entity can be processed by any machine that isrunning an instance of the distributed logical entity. On the otherhand, some of the logical entities/entities are not distributed but areinstead centralized or concentrated on one physical machine, i.e., thelogical entity has only one physical instance. Such a centralizedrouters acts as centralized point for routing packets between logicalnetwork and external routers in some embodiments. A packet requiringprocessing by a centralized logical entity has to be forwarded to themachine that is operating the centralized logical entity. Distributedlogical routers and centralized logical routers are described in U.S.patent application Ser. No. 14/814,473, titled “Logical Router withMultiple Routing Components” and filed on Jun. 30, 2015.

A datapath daemon in some embodiments when processing an incoming packetwould execute both distributed logical entities and centralized logicalentities as its pipeline stages. In some embodiments, service routers(SRs) are centralized logical routers. Each service router has only oneinstance running on one gateway machine. A datapath daemon running on agateway machine would therefore invoke the service router that iscentralized or concentrated on the gateway machine as one of itsdatapath pipeline stages.

In some embodiments, the configuration data (DP configuration database)that controls the operation of a service router stage includesdefinitions of any services the logical router should provide, whetherthe logical router will be configured in active-active or active-standbymode, how many uplinks are configured for the logical router, the IP andMAC addresses of the uplinks, the L2 and L3 connectivity of the uplinks,the subnets of any southbound interfaces of the logical router, anystatic routes for the routing information base (RIB) of the logicalrouter, as well as other data.

FIG. 4 illustrates a logical network with both distributed andcentralized logical entities. Specifically, the figure illustrates alogical view and a physical view of the logical network 300. The logicalview of the logical network 300 shows the logical relationship andconnection between the various logical entities of the network. Thephysical view of the logical network 300 shows the physicalinstantiation of the various logical entities in the physical hostmachines and the physical gateways of the datacenter.

According to the logical view, the logical network 300 includes servicerouters 311 and 312 (SR1 and SR2), logical switches 321, 322, and 323(LS1, LS2, and TLS), and distributed router 313 (DR). Among theselogical entities, the service routers SR1 and SR2 are centralizedlogical entities, while LS1, LS2, TLS and DR are distributed logicalentities.

Some embodiments provide a distributed logical router implementationthat enables first-hop routing in a distributed fashion (rather thanconcentrating all of the routing functionality at the gateways). In thephysical realization, the logical router of some embodiments includes asingle distributed routing component (also referred to as a distributedrouter or a DR) and one or more service routing components (alsoreferred to as service routers or SRs). The DR, in some embodiments,spans managed forwarding elements (MFEs) that couple directly withvirtual machines (VMs) or other data compute nodes that are logicallyconnected, directly or indirectly, to the logical router. The DR of someembodiments also spans the gateways to which the logical router is boundas well as one or more physical routers that are capable of performingrouting operations. The DR of some embodiments is responsible forfirst-hop distributed routing between logical switches and/or otherlogical routers that are logically connected to the logical router. Theservice routers (SRs) span only the edge nodes of the logical networksand are responsible for delivering services that are not implemented ina distributed fashion (e.g., some stateful services).

The physical view of the network shows the physical instantiation ofthese centralized and distributed logical entities in the actualphysical machines of the datacenter 100. As illustrated, the datacenter100 includes gateways 111-112 and host machines 121-123 that areinterconnected by physical connection 400. The instances of thedistribute elements TLS, LS1, LS2, and DR are distributed across thegateways 111-112 and the host machines 121-123. In some embodiments,different physical instances of a distributed element operate accordingto a same set of forwarding tables. However, the centralized element SR1is active only in the gateway 111 while the centralized element SR2 isactive only in gateway 112. In other words, only the datapath daemon ofgateway 111 executes SR1 as a pipeline stage and only the datapathdaemon of gateway 112 executes SR2 as a pipeline stage.

II. Datapath and External Processes

As mentioned, though a datapath daemon is a run-to-completion thread ofa processor core, some embodiments offload workload from one or more ofthe datapath stages from the datapath daemon to processes or threadsthat are external to the datapath daemon. Such processes can beperformed by the same processing core that performs the datapath daemon,by a different processing core as the core that performs the datapathdaemon, or by multiple processing cores. In some embodiments, thegateway is operating an operating system such as Linux that dividesmemory space into user space and kernel space. In some embodiments, thekernel space is reserved for running a privileged operating systemkernel, kernel extensions, and most device drivers. In contrast, userspace is a memory area where application software and some devicedrivers execute. The datapath daemon in some of these embodiments is aprocess operating in the user space. The user space datapath daemondispatches packet to processes operating in the kernel space or to otherprocesses operating in the user space in some embodiments.

In some embodiments, the datapath daemon copies packets to processes orthreads outside of the datapath daemon. This packet copying operation isanalogous to operations of a Switched Port Analyzer (SPAN), whichmirrors packet to a port for monitoring purposes. In some embodiments,such packet replication occurs when the datapath daemon is at aparticular point or stage of the datapath pipeline when processing anincoming packet. In other words, the datapath daemon mirrors packets outof the daemon before or after certain packet processing operations.

FIG. 5 illustrates a datapath daemon 510 mirroring packets to anexternal process. As illustrated, the datapath daemon 510 of a gatewaymachine 500 is processing an incoming packet 570 by executing pipelinestages that includes stages 511-514. Each of the daemon stages 511-514performs certain operations such as L2 switching, L3 routing, firewall,load balancer, NAT, etc. on the incoming packets 570. Some of the stagesalter the content of the packet (e.g., such as inserting VLAN tags orchanging source/destination addresses). As illustrated, following thedaemon stage 514, the datapath daemon produces a processed packet 574that is the result of processing the incoming packet 570 after daemonstages 511-514.

The datapath daemon 510 also mirrors packets at a mirroring point 522 ofthe datapath. The mirroring point 522 is after the daemon stage 512 andbefore the daemon stage 513. As illustrated, the datapath daemonproduces a packet 572 at the point 522, the packet 572 is the processedpacket produced by the daemon stage 512. The packet 572 then continuesonto stage 513 and 514 and becomes processed packet 574. The datapathdaemon also copies the packet 572 to create a mirrored packet 582 at thepoint 522. The datapath daemon dispatches the mirrored packet 582 toanother process 505 that is external to the datapath daemon 510. Thedispatched packet 582 reaches the other process 505 through aninter-process transport 560.

In some embodiments, the datapath daemon of an edge gateway offloadsworkload by performing one or more of its stages or operations by usingprocesses or processing threads that are external the datapath daemon.In some of these embodiments, the datapath daemon dispatches packets tothose external processes at certain points of the datapath daemon. Insome embodiments, the datapath daemon uses the result of the externalprocess to execute subsequent pipeline stages. For example, in someembodiments, a gateway datapath daemon includes a L7 load balancingstage (application layer load balancer) that dispatches packet to anexternal process or daemon to handle the load balancing tasks beforereturning a resulting packet to the datapath daemon to continuesubsequent stages.

FIG. 6 illustrates the datapath daemon 510 performing one of its stagesby using an external process (or external daemon) 605. As illustrated,the datapath daemon 510 is executing pipeline stages 611-614 forprocessing a packet 670. The stages 611, 612, and 614 are daemon stagesthat are handled by the datapath daemon. The stage 613 is a dispatchstage during which the datapath daemon 510 dispatches (or exports) apacket 682 to the external process 605 through an inter-processtransport 660. The dispatched packet 682 is a packet from an output ofthe stage 612. The external process 605 processes the packet 682 andproduces a processed packet 683, which is returned to the datapathdaemon 510 through the inter-process transport 660 (or through anotherinter-process transport). The datapath daemon 510 uses the returned data683 to continue execution of the datapath pipeline at the subsequentstage 614.

Though FIG. 6 illustrates a datapath daemon executing only one stagethat relies on an external process, one of ordinary skill wouldunderstand that in some embodiments, there can be multiple stages in thedatapath that dispatches packet to external processes or daemons forprocessing. For example, in some embodiments, a datapath daemon can haveone stage for dispatching packets to an external L7LB processing daemon,and another stage for dispatching packets to an external HTTPSprocessing daemon.

In some embodiments, an incoming packet is a control plane packet (e.g.,containing route information exchange under BGP or Border GatewayProtocol) that is destined for the control plane of the network. In someembodiments, the datapath daemon does not process the packet (as it isnot a data plane packet), but rather forward it to an external controlplane process, which consumes the packet. FIGS. 7a-b illustrate thedatapath daemon 510 handling an incoming packet that is destined for thecontrol plane by dispatching the control plane packet to a control planeprocess 705.

As illustrated, the datapath daemon 510 receives a control plane packet770 (from e.g., an external physical router) and performs stages 711 and712. After the datapath daemon performs some preliminary processingoperations at the stage 711, it dispatches the control plane packet 770to the control plane process 705 through an inter-process transport 760.The control plane process 705 in turn consumes the packet (by e.g.,storing and distributing BGP routing information.). In some embodiments,the inter-process transport forwards the mirror packet from the datapathto a network stack process initially, and the network stack process inturn forwards the mirrored packet to the control plane process. SectionIII.B below further discusses the handling of control plane traffic bypacket dispatch from the datapath daemon.

In some embodiments, the datapath daemon determines at one of its stageswhether the packet is destined for a particular control plane process.In the example of FIG. 7a , the datapath daemon makes this determinationat the dispatch stage 712. In some embodiments, such a dispatch stage isa dispatching step based on packet parsing and matching rather than anactual processing stage (as the actual processing of the stage isperformed by external control plane process 705). If the packet is apacket of the particular control plane process, the daemon dispatchesthe packet to the control plane process 705 as illustrated in FIG. 7a .If not, the datapath daemon proceeds to perform subsequent datapathpipeline stages 713 and 714 as illustrated in FIG. 7b . In the exampleof FIG. 7b , the datapath daemon 510 receives another packet 775, whichdatapath daemon 510 determines at the dispatch stage 712 not to be apacket for the control plane process 705. Consequently, the datapathdaemon does not dispatch a packet at the stage 712 but proceeds toperform stages 713 and 714.

As mentioned, in some embodiments, the gateway is operating an operatingsystem that divides memory space into user space and kernel space. Insome embodiments, both the datapath daemon and the external process areuser space processes, and the inter-process transport (550 or 750)needed for sending packets from the datapath daemon to the externalprocess are simply shared memory structures such as rings buffers in theuser space. In some embodiments, the datapath daemon is a user spaceprocess while the external process is either a kernel space process or auser space process that communicates with the datapath daemon throughkernel space process or processing thread such as a network protocolstack (e.g., TCP/IP stack.) In some of these embodiments, datapathdaemon uses user-kernel data transport mechanism such as KNI (Kernel NICInterface) or TUN/TAP virtual network kernel devices to transportpackets between the user space datapath daemon and the external process(e.g., through the kernel network stack).

A network stack, or a protocol stack is an implementation of a computernetworking protocol suite. It is therefore also referred to as a TCP(Transmission Control Protocol) stack. In some embodiments, theoperating system (such as Linux) of the gateway machine provides anetwork stack as a processing thread that operates in the kernel space.In a machine that does not implement the datapath daemon of the currentinvention, the network stack is responsible handling the networkprotocols of packets being received and transmitted by a NIC. In someembodiments that do implement a datapath daemon, the network stackhandles packets from the datapath daemon through a user-kernel transport(e.g., KNI) as if the transport is a NIC.

TUN and TAP are virtual network kernel devices that are backed up byhardware network adapters. TUN simulates a network layer device and itoperates with layer 3 packets like IP packets. TAP simulates a linklayer device and it operates with layer 2 packets like Ethernet frames.Packets sent by an operating system via a TUN/TAP device are deliveredto a user space program that attaches itself to the device. A user-spaceprogram may also pass packet into a TUN/TAP device. In this case theTUN/TAP device delivers or injects these packets to the operating systemnetwork stack (TCP/IP stack) thus emulating their reception from anexternal source.

KNI is provided by DPDK® (Data Path Development Kit) in order to allowuser space applications access to the Linux kernel. It allows managementof DPDK ports using standard Linux net tools such as ethtool, ifconfig,and tcpdump. It also functions as a NIC for receiving and transmittingpackets for the kernel network stack.

FIG. 8 illustrates a user space datapath daemon 800 that communicateswith a kernel network stack 890 through a user-kernel transport 860 anda network stack 890. The data path daemon is 800 is performing severalstages 811-814 for processing a packet 870. The user-kernel transport860 receives a packet 883 dispatched from the stage 813 (i.e., when thedatapath is performing the stage 813), and the dispatched packet 883 isdelivered to the network stack 890. The network stack 890 is in thekernel space of the operating system. The kernel network stack 890processes the dispatched packet 883 and makes it ready for consumptionby other processes in the machine such as a user space process 805 thatis external to the datapath daemon 810 (i.e., not part of therun-to-completion thread). In some embodiments, the user space processis in a namespace that the network stack 890 is able to deliver packetto. In some embodiments, the external process 805 is a control planeprocess that consumes the dispatched packet and does not return a resultpacket back to the datapath daemon as described above by reference toFIG. 7a-b . In some embodiments, the external process 805 is a dataplane process that returns a resulting packet back to the datapathdaemon 810 to continue processing as described above by reference toFIG. 6.

FIG. 9 conceptually illustrates a process 900 for performing a gatewaydatapath. In some embodiments, the process performs the stages of adatapath at the datapath daemon while dispatching packets to a processor processing thread external to the datapath daemon. The process isperformed by the processing unit(s) of the gateway machine in someembodiments. The process 900 starts when the gateway machine receives(at 910) an incoming packet from the network. This packet can be anorthbound packet leaving the datacenter through the gateway for anexternal network (e.g., external physical network 190), or a southboundpacket entering the logical networks of the datacenter through thegateway. In some embodiments, the gateway machine has a user space pollmode driver that polls the queues of the physical NIC for receiving theincoming packets.

The process then identifies (at 920) the first datapath stage to beperformed by the datapath daemon. In some embodiments, the processidentifies the next datapath stage based on the configuration datastored in the DP configuration database (i.e., 230) and the content ofthe incoming packet. The identification of a datapath pipeline stage isfurther described in in Section I above.

Next, the process performs (at 930) the packet processing of theidentified datapath stage. In some embodiments, the datapath stage canbe a stage that is performed entirely by the datapath daemon (i.e., partof the run-to-completion thread), such as the stages 611 and 612. Insome embodiments, the datapath stage can be a dispatch stage (such asthe stage 613) that dispatches packets to be processed by anotherprocess or daemon that is external to the datapath daemon (i.e., notpart of the run-to-completion thread) through an inter-process transport(e.g., the inter-process transport 560 or the user-kernel transport860). In some embodiments, the process dispatches a packet to anexternal process by redirecting the packet away from the datapathdaemon, i.e., the packet flows to the other process rather than throughthe datapath daemon, and the datapath daemon stops processing the packet(at least until the external process returns a resulting packet to thedatapath daemon). In some embodiments, the process dispatches a packetto an external process by mirroring or replicating a packet that flowthrough a specified logical port or logical entity to the externalprocess. The operations of 930 are further described below by referenceto the process 1000 of FIG. 10, the process 1300 of FIG. 13, the process1700 of FIG. 17, the process 1800 of FIG. 18, the process 2400 of FIG.24, and the process 2600 of FIG. 26.

The process then determines (940) whether the current datapath stage isthe final stage of the datapath for this packet. If the current datapathstage is the last stage of the datapath, the process 900 ends. If thecurrent datapath stage is not the last stage of the datapath, theprocess identifies (at 950) the next datapath stage to be performed(based on e.g., the DP configuration database) and returns to 930.

In some embodiments, the processed packet is a control plane packet thatis handled by a control plane process rather than by the data plane. Forsuch packets, the process 900 would end without producing any packets,because the control plane packet has already been transported to thecorresponding control plane process through the inter-process transport.On the other hand, if the processed packet is a data plane packet, theprocess 900 would produce an output packet that is to be forwarded to anext hop machine when it ends.

FIG. 10 conceptually illustrates a process 1000 for performing adatapath stage. Some embodiments perform the process 1000 when thegateway datapath process 900 performs the operation 930 to process anincoming packet.

The process 1000 starts by determining (at 1010) whether the datapathstage is a dispatch stage for a control plane process (e.g., 712), i.e.,if this is a stage that examines whether the packet should be furtherhandled by the datapath daemon. In some embodiments, the dispatch stagereceives the incoming packet after it has already been processed by oneor more previous datapath pipeline stages. If the stage is a dispatchstage for a control plane process, the process proceeds to 1020.Otherwise the process proceeds 1050.

At 1020, the process examines the packet for determining whether theincoming packet is a control plane packet of the control plane processtargeted by the dispatch stage. For example, if the dispatch stage isfor dispatching packets to a BGP control plane daemon, the process 1000would determine whether the control plane packet is a BGP packet. If thepacket is a control plane packet of the control plane process targetedby the dispatch stage, the process proceeds to 1030. If the packet isnot a control plane packet of the control plane process targeted by thedispatch stage, e.g., if the packet is a data plane packet, or if thepacket is a control plane packet that is not targeted by this dispatchstage, the process proceeds to 1080.

At 1030, the process sends the packet to the corresponding control planeprocess through the inter-process transport. In some embodiments, thecontrol plane process requires the packet to first be processed by anetwork protocol stack. For some embodiments in which the network stackis a processing thread operating in the kernel space, the process 1000would dispatch the packet to the network stack through a user-kerneltransport (such as KNI or TUN/TAP). The process 1000 then proceeds to1040 to terminate the datapath processing of the packet and ends.

At 1050, the process determines whether the packet processing stage isto be performed by the datapath daemon or is to be performed by aprocess or processing thread outside of the daemon. If the packetprocessing stage is to be performed by the datapath daemon, the processproceeds to 1060. If the packet processing stage is to be performed byan external process, the process proceeds to 1065. In some embodiments,whether a stage is to be performed by the daemon or by an externalprocess is determined by the configuration data in DP configurationdatabase, or alternatively by the programming of the datapath daemon.

At 1060, the process performs packet processing of the datapath stage atthe datapath daemon, i.e., as part of the run-to-completion thread. Uponcompletion of the processing stage, the process then proceeds to 1080.

At 1065, the process has determined that the datapath stage is to beperformed by an external data plane process. The process 1000 then sendsthe packet to the external data plane process through an inter-processtransport. In some embodiments, the external data plane process requiresthe packet to first be processed by a network protocol stack. For someembodiments in which the network stack is a processing thread operatingin the kernel space, the process 1000 dispatches the packet to thenetwork stack through a user-kernel transport (such as KNI or TUN/TAP).The process then receives (1070) the resulting processed packet from theexternal data plane process. In some embodiments, this resultingprocessed packet is received from an inter-process transport by usingthe kernel network stack. The process then proceeds to 1080.

At 1080, the process completes the processing of the current datapathstage and ends. Upon completion of the process 1000, some embodimentsproceeds to the next stage of the datapath pipeline at the datapathdaemon, or alternatively ends the datapath daemon processing of thepacket if the current stage is the last stage in the datapath pipeline.

III. Mirroring Packets to Network Stack

As mentioned, in some embodiments, the operating system of the gatewaymachine provides a network protocol stack as a processing thread in itskernel space. Such a network stack is normally used to handle networkprotocols for packets at a NIC of the gateway machine. Rather thanimplementing another network protocol stack in the user space, someembodiments leverages the existing kernel network stack to performvarious operations. Some embodiments mirrors or copies packets flowingthrough various points of the datapath and send the mirrored packets toa kernel network stack through user-kernel transport (such as KNI),which is treated as a NIC by the kernel network stack. Once the packetreaches the kernel network stack, the gateway machine is able to utilizethe functionalities of the kernel stack as if the datapath packet isdirectly provided by the physical NIC.

A. Network Traffic Dump

In some embodiments, the kernel network stack of the operating system ofthe gateway machine provide packet dump out capabilities. For example,for some embodiments that use the Linux operating system, the kernelnetwork stack supports “tcpdump” operation, which is a packet analyzerthat runs under the command line. It allows the user to display TCP/IPand other packets being transmitted or received over a network to whichthe computer is attached. In some embodiments, the datapath daemonmirrors packet to the network stack so a user of the gateway would beable to use tcpdump command to view packets flowing through variouslogical entities or logical ports of the datapath. In some embodiments,the DP configuration database of the datapath daemon specifies whichlogical ports or which logical entities should the packets be mirroredto the kernel network stack. These packets are in turn available foranalysis by tools such as “tcpdump”.

FIG. 11 conceptually illustrates a gateway machine 1100 that sendspackets at specified points of observation along the datapath to thekernel network stack. As illustrated, the gateway machine 1100 isoperating a datapath daemon 1110 in its user space and a network stack1190 in its kernel space. The user datapath daemon and the kernelnetwork stack are able to communicate packets through a user-kerneltransport 1160.

The gateway 1100 provides the northbound interface between a logicalnetwork 1150 and an external network through a physical router 1159. Thelogical network includes various logical entities: SR (service router),TLS (transit logical switch), DR (distributed router), LS-A (logicalswitch for L2 segment A), and LS-B (logical switch for L2 segment B).The SR is connected with an external physical router through an uplink“P0”. The SR is also connected with the TLS through logical port “P1”,the TLS is connected with DR through a logical port “P2”. DR isconnected with LS-A through logical port “P4” and LS-B through logicalport “P3”. The datapath daemon 1110 is processing an incoming packet1170, for which the datapath daemon invokes datapath stages 1111-1114that correspond to logical entities SR, TLS, DR, and L S-A of thelogical network 1150.

The operations of the datapath daemon are configured by a DPconfiguration database 1102, which stores the configuration data for thevarious datapath pipeline stages (configuration data for SR, TLS, DR,LS-A, and LS-B). The DP configuration database 1102 also storesspecifications for packet mirroring. Specifically, the configurationspecifies that packets reaching logical port “P2” and “P4” are to bemirrored, and the mirrored packets are to be transported to the kernelnetwork stack through the user-kernel transport 1160. In this example,packets 1172 reaching logical port “P2” are outputs of the TLS stage1112 and inputs of the DR stage 1113, and packets 1174 reaching logicalports “P4” are outputs of the DR stage 1113 and inputs of the LS-A stage1114. The datapath daemon sends these mirror packets 1172 and 1174 tothe kernel network stack 1190 through the user-kernel transport 1160.

FIG. 12 illustrates using tcpdump and kernel network space 1190 toanalyze the packet traffic of the gateway's datapath (as implemented bythe datapath daemon 1110). As mentioned, in some embodiments, the DPconfiguration database of the datapath daemon includes specification ofthe observational points to mirror packets from. In some embodiments,these specifications are provided by a user interface, which can be acommand line interface (CLI) or a graphical user interface (GUI). Asillustrated, a CLI 1220 specifies that packets at the logical ports “P2”and “P4” are to be mirrored. As a result, the packets 1172 and 1174 aremirrored to the kernel network stack 1190.

Once the mirrored packets 1172 and 1174 reach the kernel network stack,they are made available for dump out/analysis by tools such as “tcpdump”of Linux. In some embodiments, the kernel network stack copies themirrored packets to a user space buffer 1270 to be consumed by a tcpdumpprogram 1280. In some embodiments, the “tcpdump” program 1280 is a userspace program for reporting (e.g., printing out) the content of networkpackets; it can read packets from a NIC or from a previously createdsaved packet file. In some embodiments, a user can use a same userinterface (e.g., CLI 1220) to specify the points of observation/packetmirroring and to invoke the “tcpdump” command.

FIG. 13 conceptually illustrates a process 1300 for using kernel networkstack to perform packet traffic analysis of the datapath daemon in userspace. Some embodiments perform the process 1300 when it performs theoperation 930 of the process 900.

The process 1300 starts when the datapath daemon receives a packet andstarts performing datapath processing. The process then identifies (at1310) a point of observation in the datapath. In some embodiments, theDP configuration database (e.g., 230) of the datapath daemon includesthe specification of the points of observation along the datapath. Asmentioned, these points of observation can be a logical entity (logicalrouter, logical switch, etc.) or a logical port of a logical entityalong the datapath. In the example of FIG. 11, the logical ports P2 andP4 are the points of observation.

Next, the process performs (at 1320) packet processing at datapathdaemon until the next identified point of observation. In someembodiments, the datapath daemon executes the stages of the datapathpipeline according to the content of the packet (i.e., by parsing thepacket) until reaching a logical port or a logical entity that is anidentified point of observation.

The process then copies (at 1330) the packet at the point of observationand converts the packet according to a kernel-supported format. In someembodiments, this is the packet at the output of the last datapath stagebefore the point of observation. The process then sends (at 1340) theformatted copy of the packet to the kernel network stack throughuser-kernel transport so the packet would be available for reporting (bye.g., tcpdump). The operations of 1330 and 1340 are also referred to aspacket-mirroring as one copy of the packet remain with the datapathdaemon for processing while another copy is sent to the kernel networkstack for monitoring purposes.

Next, the process determines (at 1350) if there is any subsequent pointof observation in the datapath. If this is the last point of observationalong the datapath, the process 1300 ends. Otherwise, the processreturns 1310 to mirror the packet from the next point of observation. Insome embodiments, after the end of the process 1300, the datapath daemoncontinues processing the packet until the end of the datapath pipeline.

B. Control Plane Traffic

Some embodiments dispatch packets from the datapath daemon to other userspace processes. In some embodiments, these user space processes are forprocessing control plane packets of the network such as BGP packets.These packets are not to be forwarded in the data plane, but are insteadused by control plane processes such as configuring routing tables.

As mentioned above by reference to FIGS. 7a-b , datapath daemon in someembodiments forwards these control plane packets to their correspondingcontrol plane processes by packet dispatching from the datapath daemon.Specifically, the packets are dispatched to the network stack from thedatapath daemon through user-kernel transport, and the network stack inturn forwards the packet to its corresponding control plane process. Insome embodiments, a control plane packet (such as BGP packet) hasidentifiers that are recognizable by the network stack so the networkstack can deliver the packet to the corresponding control plane userprocess.

In some embodiments, the control plane process is regarded as beingperformed by a logical entity in the logical network, specifically inthe service router. In some embodiments, the datapath has a dispatchstage that corresponds to the control plane process. In someembodiments, such a stage is for determining whether the packet is forthe control plane process or not. For example, in some embodiments, thedatapath's service router includes a BGP dispatch stage for determiningwhether the incoming packet is a BGP packet. If so, the datapath daemonterminates processing of the packet (i.e., bypassing subsequent datapathstages) and let the BGP process consumes the BGP packet and performs thecorresponding BGP operations.

FIGS. 14a-b illustrates a datapath daemon 1410 that forwards BGP packetsto a BGP daemon 1405 that is external to the datapath. FIG. 14aillustrates the datapath daemon processing a data plane packet 1471. Forprocessing the packet 1471, the datapath daemon executes severalpipeline stages 1411-1416. Among these, the stage 1412 is a BGP stage.The BGP stage 1412 does not perform BGP control plane operations, but itis a dispatch stage during which the datapath daemon examines theincoming packet to determine whether it is a BGP packet. In the exampleof FIG. 14a , the packet 1471 is a data plane packet that is destinedfor the L2 segment of logical switch A (LS-A). The datapath daemontherefore does not stop at the BGP stage 1412 but instead continues toexecute all the way through to stage 1416, which correspond to LS-A.

FIG. 14b illustrates the datapath daemon 1410 processing a BGP packet1472. For processing the packet 1472, the datapath daemon 1410 excutesan initial pipeline stage 1411 and then the BGP stage 1412. Since thepacket 1471 is a BGP packet, the datapath daemon stops executing and letthe BGP daemon 1405 process the BGP packet in order to learn routes froman external router.

As illustrated, the datapath daemon 1410 dispatches the BGP packet tothe BGP daemon through a user-kernel transport 1460 and a kernel networkstack 1490. In some embodiments, this dispatching occurs when thedatapath daemon 1410 is executing the BGP dispatch stage 1412. In someembodiments, the BGP stage 1412 is part of a service router stage 1420,and the datapath daemon dispatches all packets from the uplink anddownlink interfaces of the service router 1420 to the kernel networkstack 1490. The network stack in turn processes the dispatched packetsand delivers any BGP packets to the BGP daemon 1405.

FIG. 15 illustrates the dispatching of packets from a datapath daemon toa BGP daemon. As illustrated, a gateway 1500 is executing a datapathdaemon 1510 while dispatching BGP control plane packets to a controlplane process 1505. The BGP control plane process 1505 is external tothe datapath daemon, and the dispatched packets are forwarded to the BGPcontrol plane process 1505 (BGP daemon) by a kernel space network stack1590. The BGP packets have identifiers that are recognizable by thenetwork stack 1590 so the network stack can deliver them to the BGPdaemon 1505. As illustrated, the BGP daemon 1505 is within its ownnamespace 1520, and the network stack delivers the BGP packets to theBGP process through the virtual interfaces (e.g, Veth0 or Veth1) of thename space 1520.

The datapath stages of the daemon 1510 correspond to logical entities ofa logical network 1550, which includes a service router (SR) 1511, atransit logical router (TLR) 1512, a distributed router (DR) 1513, alogical switch for L2 segment A (LS-A) 1514, and a logical switch for L2segment B (LS-B) 1515. The service router 1511 has two uplinks U1 and U2for connecting to external physical routers 1558 and 1559 as well as adownlink D1 for connecting to the TLR 1512.

Logically, the service router 1511 supports BGP exchange, though thedatapath daemon 1510 dispatches BGP packets to a BGP process 1505, whichis performed outside of the datapath daemon 1510 as illustrated. Forsome embodiments in which control plane operations are (logically)handled by the service router, each of service router's interfaces isassigned a user-kernel transport for dispatching packets to the networkstack 1590. In the example of FIG. 15, the service router 1511 has threeinterfaces that correspond to the uplink U1, the uplink U2, and thedownlink D1. The datapath daemon 1510 has at least three user-kerneltransports 1531-1532 for dispatching packets from these three interfacesto the kernel network stack 1590, and therefrom to the BGP process 1505in user space. In some embodiments each uplink of the service routergathers its own set of the BGP routing information from its owncorresponding external physical router (1558 for U1 and 1559 for U2) sothe BGP process 1505 would be able to identify BGP routing informationfrom different physical routers.

In some embodiments, BGP routing information gathered by the BGP processis used to program the routing tables and forwarding tables of thedatapath daemon. FIG. 16 illustrates the configuring of a datapathdaemon by BGP routes learned by BGP control plane processes external tothe datapath daemon. The figure illustrates a network controller 1600that fetches the routes learned by the BGP process 1505 and configuresthe datapath daemon 1510 by programming the learned routes into the DPconfiguration database 1502. The learned BGP routes are gathered fromthe BGP packets delivered to the BGP namespace 1520 by the kernelnetwork stack 1590, which receives the BGP packets from the datapathdaemon 1510 through the user-kernel transports 1530.

FIG. 17 conceptually illustrates a process 1700 by which the datapathdaemon sends control plane packet to an external control plane process.The description of the process uses BGP as example, but one of ordinaryskill would understand the process 1700 is a general process that isapplicable to other types of control plane traffic as well. In someembodiments, the gateway machine performs the process 1700 by using oneor more processing threads in user space and in kernel space. Someembodiments perform the process 1700 when the gateway datapath process900 performs the operation 930 to process an incoming packet.

The process 1700 starts when the datapath daemon receives a packet andhas performed certain preliminary processing on the packet. For someembodiments in which the datapath daemon includes a dispatch stage for aparticular control plane process (e.g., the BGP stage 1412 performed bythe datapath daemon 1410), the process starts when the packet hasreached the dispatch stage for the control plane process.

The process determines at 1710 whether the packet is a BGP packet, i.e.,if the packet is a control plane packet of the type that corresponds tothe control plane stage in the datapath. In some embodiments, thisdetermination is made based upon identifiers available within thepacket, such as transport protocol, IP addresses, etc. If the packet isnot a BGP packet (e.g., a data plane packet or a control plane packetthat is not a BGP packet), the process proceeds to 1760 for the datapathdaemon to execute the next processing stage. If the packet is a BGPpacket, the process proceeds to 1720.

At 1720, the process sends the BGP packet from the datapath daemon tothe kernel network stack through a user-kernel transport (e.g., thetransports 1531-1533). The process then terminates (at 1730) datapathprocessing of the incoming packet at the datapath daemon since thepacket is not a data plane packet.

Next, the process performs (at 1740) network stack processing on the BGPpacket, based on which the kernel network stack delivers (at 1750) theBGP packet to the BGP control plane process. In some embodiments, theBGP control plane process is a BGP daemon that operates within a BGPnamespace, and the namespace has virtual interfaces that receive packetsfrom the kernel network stack. The process 1700 then ends.

IV. Software Architecture

FIG. 18 illustrates the architecture of a gateway machine 1800 accordingto some embodiments of the invention. The memory usage of the gatewaymachine is divided into user space and kernel space. The kernel space isreserved for running a privileged operating system kernel, kernelextensions, and most device drivers. User space is the memory area whereapplication software and some drivers execute.

As illustrated, the packet processing threads 1810 (i.e., the datapathdaemon) is operating in the user space for handling L2 switching, L3routing, and services such as Firewall, NAT. Other service tasks such asARP (address resolution request) learning, BFD (bidirectional forwardingdetection) are considered slower running and therefore handled byseparate processes 1820 in the user space. These slower tasks are nothandled by the datapath daemon. The packet processing threads 1810relies on a set of DPDK libraries 1830 (Data Plane Development Kit® byIntel®) for receive packets from a NIC 1840. In some embodiments, thedatapath daemon relies on a user space NIC driver that uses poll mode toreceive packets from the NIC 1840. Some embodiments implement a flowcache 1850 for the datapath daemon. The flow cache 1850 would produce animmediate datapath processing result if the incoming packet is a cachehit while letting the datapath daemon execute if the incoming packet isa cache miss.

In the kernel space, an operating system kernel 1840 (e.g., Linux)operates TCP/IP stacks and dispatches packets from the NIC 1840 as wellas packets from the datapath daemon 1810. Some embodiments use KNI(kernel NIC Interface) to transport data between user space and thekernel space, such as between the datapath daemon 1810 and the kernelnetwork stack 1840.

As mentioned, the gateway machine in some embodiments is implemented byusing a processor having multiple cores, and that each datapath daemonperforms all of its pipeline stages in a RTC (run-to-completion) threadat one core. In some embodiments, a datapath daemon may insert a servicepipeline stage that is performed by service processes performed byanother thread at another core.

In some embodiments, these service processes communicate with the RTCthreads using some form of inter-process communications (IPC) such asshared memory or socket. A RTC thread receives packets from NICs,performs the regular L2/L3 forwarding, and classifies packet todetermine if a packet requires a service. When a packet requires aservice, the packet is sent to the corresponding service process via IPCchannel. The IPC service process dequeues and processes the packets.After processing a packet, the service process pass it back to the RTCthreads, which continues processing the packet (and may send the packetto another service process for other services.) Effectively, the RTCthreads are used to provide basic forwarding and steer packets betweenservice processes. FIG. 19a conceptually illustrates a RTC thread usingIPC to communicate with service processes in order to provide services.

In some other embodiments, a service process runs within a container anddoes not use IPC to communicate with the RTC thread and is in factunaware of the RTC threads. The process opens standard TCP/UDP socket tosend and receive packets from Linux kernel. Instead of using IPC tocommunicate between service process and RTC threads, tun/tap devices orKNI devices are created within the container. Routing table for thecontainer is properly populated so that packets sent by service processcan be routed using the proper tun/tap/KNI devices.

When a RTC thread decides that a packet needs a service, it sends thepacket to Linux kernel. After receiving the packet, Linux kernelprocesses it as if it is received from a NIC. Eventually the packet isdelivered to the service process. When the service process finishesprocessing the packet, it sends the packet to the socket. The packetwill be routed by Linux kernel towards one of the tun/tap/KNI devicesand will be received by the RTC thread. FIG. 19b conceptuallyillustrates a RTC thread using Linux Kernel to communicate with serviceprocesses in order to provide services.

V. Computing Device & Virtualization Software

Virtualization software, also known as managed forwarding element (MFE)or hypervisors, allows a computing device to host a set of virtualmachines (VMs) as well as to perform packet-forwarding operations(including L2 switching and L3 routing operations). These computingdevices are therefore also referred to as host machines. The packetforwarding operations of the virtualization software are managed andcontrolled by a set of central controllers, and therefore thevirtualization software is also referred to as a managed softwareforwarding element (MSFE) in some embodiments. In some embodiments, theMSFE perform its packet forwarding operations for one or more logicalforwarding elements as the virtualization software of the host machineoperates local instantiations of the logical forwarding elements asphysical forwarding elements. Some of these physical forwarding elementsare managed physical routing elements (MPREs) for performing L3 routingoperations for a logical routing element (LRE), some of these physicalforwarding elements are managed physical switching elements (MPSEs) forperforming L2 switching operations for a logical switching element(LSE). FIG. 20 illustrates a computing device 2000 that serves as a hostmachine or a gateway machine that runs virtualization software for someembodiments of the invention.

As illustrated, the computing device 2000 has access to a physicalnetwork 2090 through a physical NIC (PNIC) 2095. The host machine 2000also runs the virtualization software 2005 and hosts VMs 2011-2014. Thevirtualization software 2005 serves as the interface between the hostedVMs and the physical NIC 2095 (as well as other physical resources, suchas processors and memory). Each of the VMs includes a virtual NIC (VNIC)for accessing the network through the virtualization software 2005. EachVNIC in a VM is responsible for exchanging packets between the VM andthe virtualization software 2005. In some embodiments, the VNICs aresoftware abstractions of physical NICs implemented by virtual NICemulators.

The virtualization software 2005 manages the operations of the VMs2011-2014, and includes several components for managing the access ofthe VMs to the physical network (by implementing the logical networks towhich the VMs connect, in some embodiments). As illustrated, thevirtualization software includes several components, including a MPSE2020, a set of MPREs 2030, a controller agent 2040, a VTEP 2050, and aset of uplink pipelines 2070.

The VTEP (VXLAN tunnel endpoint) 2050 allows the host machine 2000 toserve as a tunnel endpoint for logical network traffic (e.g., VXLANtraffic). VXLAN is an overlay network encapsulation protocol. An overlaynetwork created by VXLAN encapsulation is sometimes referred to as aVXLAN network, or simply VXLAN. When a VM on the host 2000 sends a datapacket (e.g., an ethernet frame) to another VM in the same VXLAN networkbut on a different host, the VTEP will encapsulate the data packet usingthe VXLAN network's VNI and network addresses of the VTEP, beforesending the packet to the physical network. The packet is tunneledthrough the physical network (i.e., the encapsulation renders theunderlying packet transparent to the intervening network elements) tothe destination host. The VTEP at the destination host decapsulates thepacket and forwards only the original inner data packet to thedestination VM. In some embodiments, the VTEP module serves only as acontroller interface for VXLAN encapsulation, while the encapsulationand decapsulation of VXLAN packets is accomplished at the uplink module2070.

The controller agent 2040 receives control plane messages from acontroller or a cluster of controllers. In some embodiments, thesecontrol plane message includes configuration data for configuring thevarious components of the virtualization software (such as the MPSE 2020and the MPREs 2030) and/or the virtual machines. In the exampleillustrated in FIG. 20, the controller agent 2040 receives control planemessages from the controller cluster 2060 from the physical network 2090and in turn provides the received configuration data to the MPREs 2030through a control channel without going through the MPSE 2020. However,in some embodiments, the controller agent 2040 receives control planemessages from a direct data conduit (not illustrated) independent of thephysical network 2090. In some other embodiments, the controller agentreceives control plane messages from the MPSE 2020 and forwardsconfiguration data to the router 2030 through the MPSE 2020.

The MPSE 2020 delivers network data to and from the physical NIC 2095,which interfaces the physical network 2090. The MPSE also includes anumber of virtual ports (vPorts) that communicatively interconnects thephysical NIC with the VMs 2011-2014, the MPREs 2030 and the controlleragent 2040. Each virtual port is associated with a unique L2 MACaddress, in some embodiments. The MPSE performs L2 link layer packetforwarding between any two network elements that are connected to itsvirtual ports. The MPSE also performs L2 link layer packet forwardingbetween any network element connected to any one of its virtual portsand a reachable L2 network element on the physical network 2090 (e.g.,another VM running on another host). In some embodiments, a MPSE is alocal instantiation of a logical switching element (LSE) that operatesacross the different host machines and can perform L2 packet switchingbetween VMs on a same host machine or on different host machines. Insome embodiments, the MPSE performs the switching function of severalLSEs according to the configuration of those logical switches.

The MPREs 2030 perform L3 routing on data packets received from avirtual port on the MPSE 2020. In some embodiments, this routingoperation entails resolving L3 IP address to a next-hop L2 MAC addressand a next-hop VNI (i.e., the VNI of the next-hop's L2 segment). Eachrouted data packet is then sent back to the MPSE 2020 to be forwarded toits destination according to the resolved L2 MAC address. Thisdestination can be another VM connected to a virtual port on the MPSE2020, or a reachable L2 network element on the physical network 2090(e.g., another VM running on another host, a physical non-virtualizedmachine, etc.).

As mentioned, in some embodiments, a MPRE is a local instantiation of alogical routing element (LRE) that operates across the different hostmachines and can perform L3 packet forwarding between VMs on a same hostmachine or on different host machines. In some embodiments, a hostmachine may have multiple MPREs connected to a single MPSE, where eachMPRE in the host machine implements a different LRE. MPREs and MPSEs arereferred to as “physical” routing/switching element in order todistinguish from “logical” routing/switching elements, even though MPREsand MPSE are implemented in software in some embodiments. In someembodiments, a MPRE is referred to as a “software router” and a MPSE isreferred to a “software switch”. In some embodiments, LREs and LSEs arecollectively referred to as logical forwarding elements (LFEs), whileMPREs and MPSEs are collectively referred to as managed physicalforwarding elements (MPFEs). Some of the logical resources (LRs)mentioned throughout this document are LREs or LSEs that havecorresponding local MPREs or local MPSE running in each host machine.

In some embodiments, the MPRE 2030 includes one or more logicalinterfaces (LIFs) that each serves as an interface to a particularsegment (L2 segment or VXLAN) of the network. In some embodiments, eachLIF is addressable by its own IP address and serve as a default gatewayor ARP proxy for network nodes (e.g., VMs) of its particular segment ofthe network. In some embodiments, all of the MPREs in the different hostmachines are addressable by a same “virtual” MAC address (or vMAC),while each MPRE is also assigned a “physical” MAC address (or pMAC) inorder indicate in which host machine does the MPRE operate.

The uplink module 2070 relays data between the MPSE 2020 and thephysical NIC 2095. The uplink module 2070 includes an egress chain andan ingress chain that each performs a number of operations. Some ofthese operations are pre-processing and/or post-processing operationsfor the MPRE 2030. The operations of LIFs, uplink module, MPSE, and MPREare described in U.S. patent application Ser. No. 14/137,862 filed onDec. 20, 2013, titled “Logical Router”, published as U.S. PatentApplication Publication 2015/0106804.

As illustrated by FIG. 20, the virtualization software 2005 has multipleMPREs for multiple different LREs. In a multi-tenancy environment, ahost machine can operate virtual machines from multiple different usersor tenants (i.e., connected to different logical networks). In someembodiments, each user or tenant has a corresponding MPRE instantiationof its LRE in the host for handling its L3 routing. In some embodiments,though the different MPREs belong to different tenants, they all share asame vPort on the MPSE 2020, and hence a same L2 MAC address (vMAC orpMAC). In some other embodiments, each different MPRE belonging to adifferent tenant has its own port to the MPSE.

The MPSE 2020 and the MPRE 2030 make it possible for data packets to beforwarded amongst VMs 2011-2014 without being sent through the externalphysical network 2090 (so long as the VMs connect to the same logicalnetwork, as different tenants' VMs will be isolated from each other).Specifically, the MPSE performs the functions of the local logicalswitches by using the VNIs of the various L2 segments (i.e., theircorresponding L2 logical switches) of the various logical networks.Likewise, the MPREs perform the function of the logical routers by usingthe VNIs of those various L2 segments. Since each L2 segment/L2 switchhas its own a unique VNI, the host machine 2000 (and its virtualizationsoftware 2005) is able to direct packets of different logical networksto their correct destinations and effectively segregates traffic ofdifferent logical networks from each other.

VI. Electronic System

Many of the above-described features and applications are implemented assoftware processes that are specified as a set of instructions recordedon a computer readable storage medium (also referred to as computerreadable medium). When these instructions are executed by one or moreprocessing unit(s) (e.g., one or more processors, cores of processors,or other processing units), they cause the processing unit(s) to performthe actions indicated in the instructions. Examples of computer readablemedia include, but are not limited to, CD-ROMs, flash drives, RAM chips,hard drives, EPROMs, etc. The computer readable media does not includecarrier waves and electronic signals passing wirelessly or over wiredconnections.

In this specification, the term “software” is meant to include firmwareresiding in read-only memory or applications stored in magnetic storage,which can be read into memory for processing by a processor. Also, insome embodiments, multiple software inventions can be implemented assub-parts of a larger program while remaining distinct softwareinventions. In some embodiments, multiple software inventions can alsobe implemented as separate programs. Finally, any combination ofseparate programs that together implement a software invention describedhere is within the scope of the invention. In some embodiments, thesoftware programs, when installed to operate on one or more electronicsystems, define one or more specific machine implementations thatexecute and perform the operations of the software programs.

FIG. 21 conceptually illustrates an electronic system 2100 with whichsome embodiments of the invention are implemented. The electronic system2100 can be used to execute any of the control, virtualization, oroperating system applications described above. The electronic system2100 may be a computer (e.g., a desktop computer, personal computer,tablet computer, server computer, mainframe, a blade computer etc.),phone, PDA, or any other sort of electronic device. Such an electronicsystem includes various types of computer readable media and interfacesfor various other types of computer readable media. Electronic system2100 includes a bus 2105, processing unit(s) 2110, a system memory 2125,a read-only memory 2130, a permanent storage device 2135, input devices2140, and output devices 2145.

The bus 2105 collectively represents all system, peripheral, and chipsetbuses that communicatively connect the numerous internal devices of theelectronic system 2100. For instance, the bus 2105 communicativelyconnects the processing unit(s) 2110 with the read-only memory 2130, thesystem memory 2125, and the permanent storage device 2135.

From these various memory units, the processing unit(s) 2110 retrievesinstructions to execute and data to process in order to execute theprocesses of the invention. The processing unit(s) may be a singleprocessor or a multi-core processor in different embodiments.

The read-only-memory (ROM) 2130 stores static data and instructions thatare needed by the processing unit(s) 2110 and other modules of theelectronic system. The permanent storage device 2135, on the other hand,is a read-and-write memory device. This device is a non-volatile memoryunit that stores instructions and data even when the electronic system2100 is off. Some embodiments of the invention use a mass-storage device(such as a magnetic or optical disk and its corresponding disk drive) asthe permanent storage device 2135.

Other embodiments use a removable storage device (such as a floppy disk,flash drive, etc.) as the permanent storage device. Like the permanentstorage device 2135, the system memory 2125 is a read-and-write memorydevice. However, unlike storage device 2135, the system memory is avolatile read-and-write memory, such a random access memory. The systemmemory stores some of the instructions and data that the processor needsat runtime. In some embodiments, the invention's processes are stored inthe system memory 2125, the permanent storage device 2135, and/or theread-only memory 2130. From these various memory units, the processingunit(s) 2110 retrieves instructions to execute and data to process inorder to execute the processes of some embodiments.

The bus 2105 also connects to the input and output devices 2140 and2145. The input devices enable the user to communicate information andselect commands to the electronic system. The input devices 2140 includealphanumeric keyboards and pointing devices (also called “cursor controldevices”). The output devices 2145 display images generated by theelectronic system. The output devices include printers and displaydevices, such as cathode ray tubes (CRT) or liquid crystal displays(LCD). Some embodiments include devices such as a touchscreen thatfunction as both input and output devices.

Finally, as shown in FIG. 21, bus 2105 also couples electronic system2100 to a network 2165 through a network adapter (not shown). In thismanner, the computer can be a part of a network of computers (such as alocal area network (“LAN”), a wide area network (“WAN”), or an Intranet,or a network of networks, such as the Internet. Any or all components ofelectronic system 2100 may be used in conjunction with the invention.

Some embodiments include electronic components, such as microprocessors,storage and memory that store computer program instructions in amachine-readable or computer-readable medium (alternatively referred toas computer-readable storage media, machine-readable media, ormachine-readable storage media). Some examples of such computer-readablemedia include RAM, ROM, read-only compact discs (CD-ROM), recordablecompact discs (CD-R), rewritable compact discs (CD-RW), read-onlydigital versatile discs (e.g., DVD-ROM, dual-layer DVD-ROM), a varietyof recordable/rewritable DVDs (e.g., DVD-RAM, DVD-RW, DVD+RW, etc.),flash memory (e.g., SD cards, mini-SD cards, micro-SD cards, etc.),magnetic and/or solid state hard drives, read-only and recordableBlu-Ray® discs, ultra density optical discs, any other optical ormagnetic media, and floppy disks. The computer-readable media may storea computer program that is executable by at least one processing unitand includes sets of instructions for performing various operations.Examples of computer programs or computer code include machine code,such as is produced by a compiler, and files including higher-level codethat are executed by a computer, an electronic component, or amicroprocessor using an interpreter.

While the above discussion primarily refers to microprocessor ormulti-core processors that execute software, some embodiments areperformed by one or more integrated circuits, such as applicationspecific integrated circuits (ASICs) or field programmable gate arrays(FPGAs). In some embodiments, such integrated circuits executeinstructions that are stored on the circuit itself.

As used in this specification, the terms “computer”, “server”,“processor”, and “memory” all refer to electronic or other technologicaldevices. These terms exclude people or groups of people. For thepurposes of the specification, the terms display or displaying meansdisplaying on an electronic device. As used in this specification, theterms “computer readable medium,” “computer readable media,” and“machine readable medium” are entirely restricted to tangible, physicalobjects that store information in a form that is readable by a computer.These terms exclude any wireless signals, wired download signals, andany other ephemeral signals.

In this document, the term “packet” refers to a collection of bits in aparticular format sent across a network. One of ordinary skill in theart will recognize that the term packet may be used herein to refer tovarious formatted collections of bits that may be sent across a network,such as Ethernet frames, TCP segments, UDP datagrams, IP packets, etc.

This specification refers throughout to computational and networkenvironments that include virtual machines (VMs). However, virtualmachines are merely one example of data compute nodes (DCNs) or datacompute end nodes, also referred to as addressable nodes. DCNs mayinclude non-virtualized physical hosts, virtual machines, containersthat run on top of a host operating system without the need for ahypervisor or separate operating system, and hypervisor kernel networkinterface modules.

VMs, in some embodiments, operate with their own guest operating systemson a host using resources of the host virtualized by virtualizationsoftware (e.g., a hypervisor, virtual machine monitor, etc.). The tenant(i.e., the owner of the VM) can choose which applications to operate ontop of the guest operating system. Some containers, on the other hand,are constructs that run on top of a host operating system without theneed for a hypervisor or separate guest operating system. In someembodiments, the host operating system uses name spaces to isolate thecontainers from each other and therefore provides operating-system levelsegregation of the different groups of applications that operate withindifferent containers. This segregation is akin to the VM segregationthat is offered in hypervisor-virtualized environments that virtualizesystem hardware, and thus can be viewed as a form of virtualization thatisolates different groups of applications that operate in differentcontainers. Such containers are more lightweight than VMs.

Hypervisor kernel network interface modules, in some embodiments, is anon-VM DCN that includes a network stack with a hypervisor kernelnetwork interface and receive/transmit threads. One example of ahypervisor kernel network interface module is the vmknic module that ispart of the ESXi™ hypervisor of VMware, Inc.

One of ordinary skill in the art will recognize that while thespecification refers to VMs, the examples given could be any type ofDCNs, including physical hosts, VMs, non-VM containers, and hypervisorkernel network interface modules. In fact, the example networks couldinclude combinations of different types of DCNs in some embodiments.

While the invention has been described with reference to numerousspecific details, one of ordinary skill in the art will recognize thatthe invention can be embodied in other specific forms without departingfrom the spirit of the invention. In addition, a number of the figures(including FIGS. 9, 10, 13, 17) conceptually illustrate processes. Thespecific operations of these processes may not be performed in the exactorder shown and described. The specific operations may not be performedin one continuous series of operations, and different specificoperations may be performed in different embodiments. Furthermore, theprocess could be implemented using several sub-processes, or as part ofa larger macro process. Thus, one of ordinary skill in the art wouldunderstand that the invention is not to be limited by the foregoingillustrative details, but rather is to be defined by the appendedclaims.

What is claimed is:
 1. A method for implementing a gateway datapath fora logical network, wherein the logical network comprises a plurality oflogical forwarding elements connected by logical ports, the methodcomprising: receiving a packet at the gateway datapath, the gatewaydatapath executing in a user space of a computing device to processpackets through sets of pipeline stages corresponding to the logicalforwarding elements; executing a set of the pipeline stages to processthe received packet through a set of the logical forwarding elements andlogical ports; and replicating a copy of the packet to a kernel networkstack by transporting the packet copy from the user space to the kernelspace through a user-kernel transport upon processing the packet througha particular one of the pipeline stages identified by the gatewaydatapath as an observation point for the logical network, wherein thekernel network stack enables a process executing in the user space ofthe computing device to access the packet copy.
 2. The method of claim1, wherein the set of pipeline stages is executed as a run-to-completionthread of the gateway datapath.
 3. The method of claim 1, wherein thesets of pipeline stages operate according to configuration data providedby a configuration database, wherein the configuration database furtherspecifies the observation point.
 4. The method of claim 1, wherein thelogical forwarding elements of the logical network comprise distributedlogical routers, logical switches, and service routers.
 5. The method ofclaim 1, wherein the observation point identified by the gatewaydatapath is a logical port of a logical forwarding element that isidentified by the particular pipeline stage.
 6. The method of claim 1,wherein the observation point identified by the gateway datapath is alogical forwarding element to which the particular pipeline stagecorresponds.
 7. The method of claim 1, wherein the process executing inthe user space that accesses the packet copy from the kernel networkstack is for producing a report of packet traffic through the gatewaydatapath.
 8. The method of claim 7, wherein the process is a packet dumpcommand provided by the operating system.
 9. A non-transitory machinereadable medium storing a program that when executed by at least oneprocessing unit of a computing device implements a gateway datapath fora logical network, the program comprising sets of instructions for:receiving a packet at the gateway datapath, the gateway datapathexecuting in a user space of the computing device to process packetsthrough sets of pipeline stages corresponding to the logical forwardingelements; executing a set of the pipeline stages to process the receivedpacket through a set of the logical forwarding elements and logicalports; and replicating a copy of the packet to a kernel network stack bytransporting the packet copy from the user space to the kernel spacethrough a user-kernel transport upon processing the packet through aparticular one of the pipeline stages identified by the gateway datapathas an observation point for the logical network, wherein the kernelnetwork stack enables a process executing in the user space of thecomputing device to access the packet copy.
 10. The non-transitorymachine readable medium of claim 9, wherein the set of pipeline stagesis executed as a run-to-completion thread of the gateway datapath. 11.The non-transitory machine readable medium of claim 9, wherein the setsof pipeline stages operate according to configuration data provided by aconfiguration database, wherein the configuration database furtherspecifies the observation point.
 12. The non-transitory machine readablemedium of claim 9, wherein the logical forwarding elements of thelogical network comprise distributed logical routers, logical switches,and service routers.
 13. The non-transitory machine readable medium ofclaim 9, wherein the observation point identified by the gatewaydatapath is a logical port of a logical forwarding element that isidentified by the particular pipeline stage.
 14. The non-transitorymachine readable medium of claim 9, wherein the observation pointidentified by the gateway datapath is a logical forwarding element towhich the pipeline stage corresponds.
 15. The non-transitory machinereadable medium of claim 9, wherein the process executing in the userspace that accesses the packet copy from the kernel network stack is forproducing a report of packet traffic through the gateway datapath. 16.The non-transitory machine readable medium of claim 15, wherein theprocess is a packet dump command provided by the operating system. 17.The method of claim 1, wherein the kernel network stack treats thepacket copy as though received from a network interface controller ofthe computing device.
 18. The method of claim 1, wherein the kernelnetwork stack enables the process executing in the user space to accessthe packet copy by storing the packet copy in a user space bufferconsumed by the process.